# Create server integration credentials

Find your Environment ID, Site Key, Access Key, and Content ID. Keep credentials on your trusted backend.

Canonical: https://docs.drm-x.com/get-started/credentials
Updated: 2026-09-05

![Illustrated Console values using placeholders. Access Keys stay on your server; this contains no customer credentials.](https://docs.drm-x.com/assets/console-values.svg)Illustrated Console values using placeholders. Access Keys stay on your server; this contains no customer credentials.

Account setup 

## Copy the four values used by the quick start[#](#copy-the-four-values-used-by-the-quick-start)



Create a playback API client in [Console → Integrations](https://6.drm-x.com/console/integrations) and grant only `license-tokens:create`. Get the Content ID from the Published protected file created in [Console → Package content](https://6.drm-x.com/console/package-content).



![Redacted Console illustration showing Environment ID, Site Key, one-time Access Key, and Published protected file Content ID](https://docs.drm-x.com/assets/console-values.svg)This is a redacted illustration, not a customer screenshot. Access Keys must remain server-side. 

### PHP code-first settings



```
return [
'platformApi' => 'https://api6.drm-x.com',
'siteId' => 'your-development-environment-uuid',
'siteKey' => 'drmx_your_environment_scoped_client_id',
'accessKey' => 'paste-your-one-time-access-key',
'applicationId' => 'customer-php-website',
'content' => [
'id' => 'your-published-content-id',
'title' => 'Your protected title',
'type' => 'vod',
],
'licensePolicyTemplate' => 'multi-tier-standard',
'licensePolicy' => null,
'licenseDeliveryMode' => 'direct-token',
];
```



No environment variables are required for the downloaded quick start. The example contains commented production alternatives for environment or secret-manager injection.



**Never ship these values**Do not place the Site Key or Access Key in HTML, JavaScript, an APK, an IPA, application resources, mobile CI variables, URLs, logs, analytics, or downloadable configuration. 

Use a different API client for each application or backend service so one credential can be rotated or revoked without interrupting every integration.